root password AWOL!

Hi all,

Strangely, the root password I had always used on my system decided to
suddenly make itself unavailable.

Without altering the password, I tried to su root in my terminal
only to get the message 'invalid password'.

I booted from the SuSE 7.3 CD and edited /etc/shadow deleting root's
password; after rebooting, I supplied root with a new one.

But here's the interesting thing: Now, whenever I su root, it gives me
root's prompt immediately -without asking me for its password.

Not a desirable situation.

Any ideas will be greatly appreciated; Thank you!

AeoN
--
SusE 7.3 / Bash

"AeoN" <(E-Mail Removed)> wrote in message
news:0ClZc.46304$(E-Mail Removed)

> Strangely, the root password I had always used on my system decided to
> suddenly make itself unavailable.
>
> Without altering the password, I tried to su root in my terminal
> only to get the message 'invalid password'.
>
> I booted from the SuSE 7.3 CD and edited /etc/shadow deleting root's
> password; after rebooting, I supplied root with a new one.
>
> But here's the interesting thing: Now, whenever I su root, it gives me
> root's prompt immediately -without asking me for its password.

Sounds like a hack job ... better wipe and re-install, then carefully assess
your security measures before connecting to a network again.


tony

--
use hotmail for email replies

On 2004-09-01, AeoN <(E-Mail Removed)> wrote:
> Strangely, the root password I had always used on my system decided to
> suddenly make itself unavailable.
<zap>
> But here's the interesting thing: Now, whenever I su root, it gives me
> root's prompt immediately -without asking me for its password.

Sound suspiciously like you've been rooted... I'd format and reinstall...

Davide

--
"People think love is an emotion. Love is good sense."
-- Ken Kesey

On 2004-09-01, AeoN <(E-Mail Removed)> wrote:
>
> [snipped]
>
> But here's the interesting thing: Now, whenever I su root, it gives me
> root's prompt immediately -without asking me for its password.
>
> Not a desirable situation.
>
> Any ideas will be greatly appreciated; Thank you!
>
I personally think you (someone else?) has been playing with PAM and mucked
things up.... :P

If someone had rooted your box they would be quite stupid to change the
computers behavior in this way and probably have some other 'hidden' method
to gain root. Think about it, whats the point in rooting a box and firing
off "hey I rulz"....sure there are some that do this but its more the
minority from what I have seen.

I know you have not being pondering the 'rooting' bit, but its just my £0.02


What happens with 'su' when you try to su to another user on your machine
(create a temporary user if need be).

Cheers

Alex

Alexander Clouter wrote:

> On 2004-09-01, AeoN <(E-Mail Removed)> wrote:
>>
>> [snipped]
>>
>> But here's the interesting thing: Now, whenever I su root, it gives me
>> root's prompt immediately -without asking me for its password.
>>
>> Not a desirable situation.
>>
>> Any ideas will be greatly appreciated; Thank you!
>>
> I personally think you (someone else?) has been playing with PAM and
> mucked things up.... :P
>
> If someone had rooted your box they would be quite stupid to change the
> computers behavior in this way and probably have some other 'hidden'
> method
> to gain root. Think about it, whats the point in rooting a box and firing
> off "hey I rulz"....sure there are some that do this but its more the
> minority from what I have seen.
>

I have not had any adverse effects. It is doubtful that anyone can get past
the firewall and root my box, and I know that no one in the office has any
hacker skills whatsoever.

> I know you have not being pondering the 'rooting' bit, but its just my
> £0.02
>
>
> What happens with 'su' when you try to su to another user on your machine
> (create a temporary user if need be).
>

su works fine with other users, and root.


> Cheers
>
> Alex



--
SusE 7.3 / Bash

Davide Bianchi wrote:

> On 2004-09-01, AeoN <(E-Mail Removed)> wrote:
>> Strangely, the root password I had always used on my system decided to
>> suddenly make itself unavailable.
> <zap>
>> But here's the interesting thing: Now, whenever I su root, it gives me
>> root's prompt immediately -without asking me for its password.
>
> Sound suspiciously like you've been rooted... I'd format and reinstall...
>
> Davide
>

WAY too over-the-top!

--
SusE 7.3 / Bash

if it is just the root password

why not put in rescure disk bootup

mount / (which has /etc/ in it i hope)

vi /etc/shadow

and put in a blank entry for password for root


reboot

log in as root

password (press enter)


now logged in do

passwd root


and (give it a new password)


if other things are comprised run a find_ddos check (compare ls ps etc
with ls ps from another machien with the same build )

You normally notice a comprise things dont appear like they should i.e.
dodgy processes as well disk space issues and response of machine if
being used for heavy network traffic usage by hackers.




AeoN wrote:
> Davide Bianchi wrote:
>
>
>>On 2004-09-01, AeoN <(E-Mail Removed)> wrote:
>>
>>>Strangely, the root password I had always used on my system decided to
>>>suddenly make itself unavailable.
>>
>><zap>
>>
>>>But here's the interesting thing: Now, whenever I su root, it gives me
>>>root's prompt immediately -without asking me for its password.
>>
>>Sound suspiciously like you've been rooted... I'd format and reinstall...
>>
>>Davide
>>
>
>
> WAY too over-the-top!
>